The Internet is a vast, public network of interconnected computers and smaller networks. As such, the Internet can provide a vehicle for monetary transactions, such as the purchasing of goods and services by consumers. Although these so-called “e-commerce” or “on-line shopping” transactions are reasonably common, the amount of e-commerce taking place over the Internet has generally fallen below historical expectations.
Security concerns of users and merchants alike have been partly to blame for the somewhat limited use of the Internet for e-commerce such as shopping. For example, there is no common way of reliably authenticating the user and creating records of transaction authorization that are viewed as non-repudiatable to the same extent as traditional paper records. A digitally signed purchase contract using the Public Key Infrastructure (PKI) might be used to create such a record. In theory, PKI allows authentication and signature of an electronic document with a user's key pair consisting of a public and private key. However, personal computers (PC's), which have been the most common client device used for e-commerce, have not been considered suitable for client-side PKI. Client-side PKI involves the ability to store keys on the client platform in a tamper resistant medium. There has been no widespread deployment of a device that provides this ability for a PC.
With the recent advent of mobile e-commerce, a security element (SE) is becoming an essential component of mobile phones and other mobile terminals, hereafter referred to simply as “mobile terminals” or “wireless communication terminals”. The SE is a tamper-resistant, trusted component in a terminal that contains the private and public key-pairs used for authentication and digital signature functions in secure transactions. The SE may take many forms, including removable and non-removable types, relative to the mobile terminal. A well-known removable type of security element is the subscriber identity module (SIM), currently used in telephones that operate according to the Global System for Mobile (GSM) standard. Another known removable security element is the WAP identity module (WIM) where WAP stands for wireless application protocol, an over-the-air protocol designed to carry Internet traffic so that wireless communication terminals can run Internet protocol (IP) applications and be used for Internet access. Specifications for WAP can be obtained from the WAP Forum at www.wapforum.org. A device that has telephone capability and WAP capability needs both SIM and WIM functionality, which may be provided by separate devices, or by a combination card with both functions, colloquially called a “SWIM” card.
The PKI capability of some mobile terminals provides a way of authenticating on-line transactions taking place over the wireless network. However, the mobile terminal does not provide a very pleasant “on-line shopping experience” due to its small, often monochrome screen and limited input/output (I/O) capabilities. There have been proposals to use the PKI capability of some mobile terminals to authenticate PC-based Internet transactions by locally connecting a user's mobile terminal to the user's PC, for example, with so-called “Bluetooth” short range radio technology. Thus far, however, hardware and software to accomplish this local connection has not become widely available.